Binarized neural networks [1]}, [2]}, [3]} have weights and activations constrained to be near +1 and -1 (or 1 and 0) whereas our model weights are real numbers. The purpose of those networks is efficiency as opposed to robustness. Indeed we see in recent work that binarized networks offer marginal improvements in robustness to substitute model black box robustness on MNIST and none in CIFAR10 (see Tables 4 and 5 in [1]} and Table 8 in [5]}).
